Breakfast at 7:20 a.m., and Almost No Cash in Sight
At a breakfast cart on Wanhangdu Road in Shanghai, a woman in a company lanyard orders a jianbing — egg, scallion, crispy cracker — and pays six yuan. She does not open a wallet. She points her phone at a laminated QR code taped to the side of the cart, taps once, and waits four seconds while the vendor folds the crepe. He never looks up from the griddle.
That scene repeats in some form tens of millions of times a day across China. More than 900 million people in the country use mobile payments, according to the China Internet Network Information Center, and two apps — Alipay, run by Ant Group, and WeChat Pay, run by Tencent — handle the overwhelming majority of small retail transactions.
Cash has not disappeared. Rural markets, older customers and smaller towns still run on banknotes, and the People’s Bank of China has repeatedly fined businesses that refuse to accept them. But in big cities, a full cash-only day is now unusual enough to be memorable.
For anyone arriving from abroad, this raises an obvious question. If all it takes to move money is a phone and a printed square of pixels, why is everyone’s balance not being drained? The honest answer is that the QR code is the least interesting part of the system.
What Happens in the Few Hundred Milliseconds After You Scan
A payment QR code generated by a merchant does not contain your bank card number. It carries a token tied to that merchant and that moment. When a customer confirms payment, the app sends an encrypted instruction; the merchant never sees the raw credential, and in most cases the app does not store the card number either — the bank or the licensed payment institution holds it, and the app keeps a token that is useless anywhere else.
Before that instruction leaves the phone, the app has already attached a package of signals: the device fingerprint, whether the handset is newly registered, whether the SIM card was swapped recently, the IP address and Wi-Fi network, GPS location, the account’s payment history with this particular merchant, and behavioural details such as how long the user paused before tapping confirm.
Payment companies describe scoring models built on hundreds of such variables. Alipay’s risk-control engine returns a decision in tens of milliseconds. Three outcomes are possible: approve, approve but demand a challenge — a fingerprint, a six-digit code, or a 3D face scan for larger transfers — or decline outright.
The critical design choice is timing. In China, the fraud decision happens before the money moves, not after. Alipay has publicly put its fraud loss rate below 0.00001 percent of transactions. That number cannot be independently verified from outside, and it covers only fraud on the platform, not cases where a user is talked into transferring money voluntarily. Even treated loosely, the order of magnitude is the point.
There is also an architectural layer most users never think about. Since 2017, traffic between third-party payment apps and banks has been routed through a single central clearing entity, NetsUnion Clearing Corporation, created under the central bank’s direction. Previously Alipay and Tencent connected to banks bilaterally, which meant the regulator could not see the whole picture. Now every transaction passes through one pipe that the central bank owns.
The Regulator Sitting in the Middle of the Flow
China’s payment safety is not purely a private-sector achievement. The People’s Bank of China sets the rules that make the technology matter.
Only licensed non-bank payment institutions may hold customer money. The number of licences peaked at 271 and has since fallen below 200 as operators were retired for violations or inactivity — a deliberate thinning of the field rather than a free-for-all.
Since January 2019, 100 percent of customer reserve funds held by payment institutions must be deposited with the central bank. Payment firms cannot lend out, invest or otherwise touch the balances sitting in your app. This is a stricter arrangement than the e-money models in several other markets, where floats are invested and the safety of the balance depends on the firm’s own solvency.
Accounts are tied to real identities. Since 2016 and 2017, payment accounts must be linked to an ID document and a bank account, and they come in tiers with hard limits: the weakest tier is only good for small payments, and the higher tiers require stronger verification.
Two more pieces of law matter. The Anti-Telecom and Online Fraud Law, in force since December 1, 2022, gives banks, telecom operators and payment platforms a legal duty to monitor, warn, delay and freeze suspicious transactions. And a 2024 regulation, the Regulations on the Supervision and Administration of Non-Bank Payment Institutions, raised payment supervision to the level of an administrative regulation for the first time.
Behind these sits an enforcement campaign that few outsiders have heard of. Operation Card-breaking, launched in October 2020, targets mule accounts — bank cards and SIM cards rented or sold to fraud rings. Renting out your own bank card is now a chargeable offence, and the campaign has removed much of the raw material that cross-border scam operations rely on to move money.
When the Money Goes to the Wrong Person
Two situations look similar from the outside and behave completely differently in practice.
In the first, someone is tricked. A caller claims to be from the police, or a fake customer service agent talks a user into a transfer. The victim calls 96110, the national anti-fraud hotline, or goes to a police station. Officers can push a freeze request through a bank-police coordination system. If the money has not yet been layered through several accounts, it can be frozen and eventually returned. Speed decides everything, which is why both major apps delay transfers to non-contacts for up to 24 hours and allow the sender to cancel, and why large transfers to a first-time recipient often trigger a face scan.
In the second situation, someone simply types a wrong digit and sends 5,000 yuan to a stranger. Here there is no magic button. The money has legally become the recipient’s, and getting it back is an unjust enrichment claim under Article 985 of China’s Civil Code. Platforms will contact the recipient on the sender’s behalf, and most people return the money. If they refuse, it becomes police mediation or a civil lawsuit. That is a genuine limit, and it is worth stating plainly: in China, safety usually means recoverability plus a legal process, not instant reversal.
Why This Model Is Hard to Copy Somewhere Else
Card systems in the United States and Europe were designed around disputes after the fact: chargebacks, 60- to 120-day windows, and liability shifting between banks, processors and merchants. That machinery is paid for by interchange fees of roughly 1.5 to 3 percent. In China, merchant fees on QR payments are far lower, often around 0.6 percent or less. There is simply no pot of money to fund a large chargeback bureaucracy — so the system had to stop fraud before authorisation instead of arguing about it afterwards.
Card rails also historically settled in batches, often overnight. Chinese mobile payments settled instantly, which forced banks and processors into real-time clearing. Add two dominant apps, and you get a single risk graph: a device that has just been used for a suspicious transfer on Alipay looks suspicious on WeChat Pay too, because the underlying fraud patterns are similar and the data pool is enormous.
Uniformity matters as well. A vegetable seller and a shopping mall display the same kind of code, so there is no patchwork of incompatible security levels for a fraudster to exploit.
The Friction Nobody Advertises
None of this is free. Real-time risk scoring produces false positives. Accounts get frozen after receiving money from a stranger, and the owner may spend days at a bank branch proving where the funds came from. Chinese social media regularly carries complaints about exactly this.
Biometric and behavioural data raise a second cost. The Personal Information Protection Law, effective in 2021, requires separate consent for biometric information, and Supreme People’s Court rules have restricted facial recognition in public places. But the volume of data collected for risk control remains large, and the balance between fraud prevention and privacy is an argument that is still running.
Foreign visitors hit a third edge. For years, overseas cards could not be linked to Alipay or WeChat Pay at all. Since 2023, both allow Visa and Mastercard, with transaction limits, and prepaid tourist options exist. It works better than it did. It is still not seamless.
Safety as a System, Not a Feature
The security of Chinese mobile payment is not one clever invention. It is tokenized transactions, behavioural risk scoring, instant settlement, a single central clearing house, licensing, 100 percent reserve deposits, an anti-fraud law, a police-bank freeze mechanism, and a population that has broadly accepted real-name accounts. Remove any one layer and the whole thing weakens.
It also produces side effects, and those are visible to anyone who looks: the same machinery that freezes a scammer’s account occasionally freezes an innocent one. The most useful test for a visitor is not the technology briefing. It is buying breakfast with your phone and noticing how completely unremarkable it feels.
Start the discussion at forum.chinacomes.com